Anyone know what this log is?
I have a site (which is built in Django and Jquery) https://sqlpad.io and I constantly saw the following error messages, seems like those are bots scanning my site and assumes it's built in wordpress? It has become annoying recently (sometimes I receive hundreds of them a day).
Referrer: www.google.com
Requested URL: /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php
User agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
IP address: 10.45.182.145
Thanks,
Yep, that just bots browsing the web looking for vulnerabilities. You can block them with a firewall rule (not sure that really worth it tho)
Right, probably not worth the energy : ) Thanks for your input.
Don't worry about it. Automated security vulnerability scanning. Ignore everything that doesn't match your server config or language (most are for PHP vulnerabilities or common software and you don't serve PHP executables).
Check your site against shodan.io if you're ever curious. Like:
https://www.shodan.io/host/3.221.203.32
(I see you're only exposing ports 443 and 80 -- which seems pretty ideal)
Thanks, makes sense, shodan.io is pretty cool!
There's nothing you can do about it. It's a bit looking for vulnerabilities and it will just try random things in the hope it will find a vulnerability.
On Linux you can use something called Fail2Ban. It auto blocks too regular requests. It won't eliminate what you are seeing but it either likely greatly reduce it
Makes sense, thanks for your input.
Is it this?
https://www.wordfence.com/blog/2020/09/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin/
Thanks, it might be related. Even though my site is not build in wordpress, bots are still trying to scan things that don't exist.
Have you tried adding & configuring CloudFlare under 'high security' settings?
Nah, I have not got a chance to configure CloudFlare yet, thanks for the pointer, will check it out.
This comment was deleted 5 years ago
Ah, I see, this must be it. The log shows it coming from 10.* ip addresses, guess they are all fake.
If the IP were fake, the back packets would never return to the sender, so the TCP SYN/ACK connection handshake could not establish in the first place. No, that IP is real. Are you sure it's not the internal IP address of your load balancer or proxy?
I think you are right, just checked my logging settings, those are internal ips. (not the one where the bot comes from). Thanks for your input!
This comment was deleted 5 years ago